Canon Lee Secondary School City of York Council Internal Audit Report 2015/16

Business Unit: Children's Services, Education & Skills, Headteacher: R Crane Date Issued: 10/06/2016 Status: Final Reference: 15658/004

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Tuesday 19th April and Wednesday 20th April 2016 as part of the Internal Audit plan for Education, Skills and Children’s Services for 2015/16

Objectives and Scope of the Audit The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority’s Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise.

The audit covered the following areas in accordance with the specification issued on 17th September 2015:

- Governance;
- Financial Management;
- System Reconciliation;
- Petty Cash
- Contracts – Ordering, Purchasing and Authorisation;
- Income;
- Capital and Property;
- Additional School Activity Provision;
- Human Resources;
- Payroll;
- School Meals;
- Pupil Numbers;
- Voluntary Funds Monitoring Arrangements;
- Data Protection and Information Technology;
- Insurance and Risk Management;
- Joint Use Facilities;
- Inventory Records;
- Minibus.
- Security; and
- Safeguarding Arrangements. Key Findings Changes in staffing from December 2015 had resulted in some delays in updating some of the schools financial records. However, the current School Business Manager now in post, with the help of the new Finance Officer, is in the process reviewing and streamlining the financial systems and addressing any issues which may have occurred during this time. The key findings in the audit related to the operation of an unlicensed and unsupported Financial Management System, access to the register of Interests for Governors and Staff, monitoring of lettings income, the maintenance and audit of the school fund accounts and the inclusion of the Publication Scheme on the schools web-site.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance 1 Financial Management System

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school is currently operating an unsupported Financial Management System. | The integrity of the financial records may be compromised and the school may be unable to produce the required financial statements, reports and statutory returns. |

Findings

A decision was made at the School Business Committee to delay the transition to the new Civica Finance Management System on 1st April 2015 and continue with the unsupported RM Finance pending the initial operational problems with the new system being resolved. Migration to the new system was initially planned to take place around November 2015 however, mainly due to staff changes this did not take place. The full Governing Body was kept informed of the situation.

At the time of the audit the school continued to operate the unlicensed and unsupported RM Finance system. Discussion of the options to move to the Civica System, continue with RM or investigate the possibility of moving to PS Financials as a possible solution (the system used by Hope Academy Trust with which it is proposed that the school will join).

Recommendation

The Governors should be advised of the risks of remaining with an unlicensed and unsupported finance system and a decision made in consultation with the LA on the way forward for the current year.

Agreed Action 1.1

As the school is currently transitioning to academy status. We are moving to PS Financials and with the appointment of a new Finance Officer, who is commencing on 6th June 2016. An initial training session is being held at Hope Learning Trust on the 26th May 2016 to commence the accounting transition. The RM Financial system is still in operation and the Governors have been formally informed during the Business Committee meeting on 3rd May 2016.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Business Manager | 31-08-16 | 2 Register of Interests

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The current Register of Interest for Governors was not held at the school and declarations of interest for staff were not readily available. Governors and staff with financial responsibilities may be in a position to influence purchasing decisions and are required to complete a declaration of relevant business interests updated on an annual basis. | The school may be unable to fully account for purchasing decisions in the event of challenge. |

Findings

The current register of Interests for the Governors at the school was held by the Clerk to the Governors and not available at the school to be reviewed against purchasing decisions. Additionally staff declarations were held on individual personal files and not as a complete record.

Recommendation

A complete and current register of interests for Governors should be held at the school. Relevant interest declared by Governors must be published on the schools website. Declarations completed by staff should be held as a complete record with any relevant interests highlighted, in particular for staff with financial responsibilities (at minimum those staff able to authorise orders and members of the Senior Leadership team).

Agreed Action 2.1

Information is being collated to retain on school premises. As part of our compliance audit of the school website this information will be presented in the near future.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | PA to SLT | 15-06-16 |

### 3 Lettings

| Issue/Control Weakness | Risk | |------------------------|------| | Overdue payments were not effectively highlighted for follow up. | All income due may not be collected and lettings arrears may increase by continuing arrangements with organisations that fail to pay. |

#### Findings

The lettings system was reviewed and it was noted that the spreadsheet used to monitor payments made against invoices raised had not been updated for a significant period during staff changes. Although a new system was in place which worked well to highlight recent unpaid invoices the full extent of outstanding balances was unclear. A number of organisations make part payments of lettings charges and the need to have an effective payments monitoring system is particularly relevant in these cases.

#### Recommendation

It should be ensured that the spreadsheet used to monitor payment of invoices is up to date and any overdue outstanding balances should be chased promptly.

#### Agreed Action 3.1

This is being addressed inline with the financial transition to the Hope Learning Trust system. Lettings will be invoiced via PS Financials. In the meantime, outstanding payments will be chased and the spreadsheet reconciled as a priority.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Finance Officer | 15-06-16 | 4 Contractors Insurance

| Issue/Control Weakness | Risk | |------------------------|------| | Some contractors completing works at the school in the last 12 months did not have evidence of adequate insurances on file. | Costs may be incurred by the school in the event of a claim. |

Findings

Copies of insurance certificates and CHAS registrations are held on file for contractors used by the school. However, sample testing for five contractors directly commissioned to complete works at the school in the last 12 months highlighted that three did not have proof of adequate public liability insurance on file.

Recommendation

For contractors directly commissioned to carry out works at the school, a current copy of the contractor’s public liability insurance certificate, evidencing cover of at least £5m should be requested and retained. If a contractor is used on a regular basis, a system should be in place to ensure that an up to date copy of the insurance certificate is obtained when the expiry date has been reached.

Agreed Action 4.1

Our procedures are being enhanced to reflect the above. Some contractors within our file have not worked during the past 12 months and therefore information will not be updated until they plan to work on our site. For safe guarding and health & safety compliance, our preferred contractor is the City of York Council. Periodic review of the contract file is now in place. A formal annual review meeting is scheduled with the site team to provide guidance, review and procedural updates/checks.

| Priority | 3 | |----------|---| | Responsible Officer | Business Manager | | Timescale | 31-07-16 | 5 School Fund

| Issue/Control Weakness | Risk | |------------------------|------| | School fund accounts were not up to date and regular bank reconciliations had not been completed. The accounts for 2014/15 had not been independently audited. | The position of the fund cannot be effectively monitored and any discrepancies may not be highlighted and investigated. |

Findings

Good controls appear to be in place for the receipt and banking of income and authorisation of expenditure. However, since December 2015 the school fund accounts have not been updated and formal bank reconciliations had not been completed. This appears to have occurred as a result of limited staff resources during this period. It was also noted that the accounts to 31/3/15 had not been independently audited.

Recommendation

The school fund accounts should be updated and the completion of regular independently verified bank reconciliations reintroduced.

The accounts to 2014/15 should be independently audited and presented to the Business Committee.

Agreed Action 5.1

Due to the change in the Financial staffing, this will be prioritised as a task for our new employee to address on handover with the current Finance Officer. On handover this will be targeted completed as a matter of urgency.

| Priority | 3 | |----------|---| | Responsible Officer | Finance Officer | | Timescale | 30-06-16 |

### 6 Publication Scheme

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school had not published their Publication Scheme for Schools and associated Guide to Information on their website. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA) and statutory requirements may be breached. |

#### Findings

The Full Governing Body adopted the Information Commissioners Publication Scheme and Guide to Information 9th July 2014. The school had not published the scheme on the school’s website.

#### Recommendation

It is recommended that the school review their Publication Scheme and Guide to Information to ensure it is the latest version which can be obtained from the ICO website and must be adopted in full, unedited and promoted alongside the Guide to Information. The approved Publication Scheme should be made available by publishing on the school’s website and where possible links to electronic versions of information should be included.

#### Agreed Action 6.1

As part of our compliance audit of the school website this information will be presented in the near future.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Business Manager | 15-06-16 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.